chore(main): release 9.0.0

[botantler-1]

🤖 I have created a release beep boop

9.0.0 (2026-07-03)

⚠ BREAKING CHANGES

• remove the sync-github-labels composite action (superseded by declarative IssueLabels) (#418)
• All callers referencing old file names, input names, output names, or secret keys must be updated.
• run-dotnet-tests: run-dotnet-tests no longer accepts app-id or app-private-key inputs. Callers pinning by SHA are unaffected; on repin any still-passed values are simply ignored (unexpected-input warning).
• the setup-copilot-skills/update-copilot-skills action paths are removed and setup-agent-skills's agent input is renamed to agents. Consumers on a pinned major (e.g. @v4) are unaffected until they bump; migration guides are in each action's README.
• the codecov-token input is removed from both actions. Callers must stop passing it (the reusable workflows are updated in lockstep).
• copilot-skills: setup-copilot-skills and update-copilot-skills both remove the skills-lock input; setup-copilot-skills also removes the source input and redefines skills as the sole list input. Delete any skills-lock.json and move each entry onto its own <owner/repo> <skill> line in setup-copilot-skills.with.skills.
• Action directories and input names have been renamed.

Features

• add .NET project and test configurations (#10) (1ce56da)
• add require-checks-in-pr composite action (#113) (1f66c91)
• add auto-merge composite action for PRs (#14) (a8f34bd)
• add automation configuration for PR reviews and issue sessions (f4b7152)
• add blocked label and update label sync configuration (3041247)
• add Calculator class with basic arithmetic operations and corresponding unit tests (f5c21a1)
• add collapsible sections for workflow details in README (2e8d0f9)
• add docs (aba6c52)
• add dotnet-test-action for testing .NET solutions with GitHub Actions (ad39d59)
• add EditorConfig file and update Calculator and CalculatorTests for consistency and clarity (f032439)
• add GitHub workflows (861d3e2)
• add GitOps deployment workflow for managing Kubernetes resources (f6f0ce7)
• add GitOps validation workflow (8505da2)
• add Hadolint action for linting Dockerfiles (9f610a8)
• add Homebrew setup and environment initialization to GitOps workflows (c4b0fe5)
• add Homebrew setup step to GitOps workflows for consistent environment setup (e300bd6)
• add initial release configuration for semantic-release (3c4f906)
• add inputs for HOSTS_FILE and ROOT_CA_CERT_FILE in GitOps workflow (6eefeeb)
• add pull_request and merge_group triggers to Zizmor workflow (1ce3f4b)
• add pull_request trigger to auto-merge and dotnet-test workflows (63097da)
• add pull_request trigger to GitOps lint and test workflows (dbd5fe8)
• add released label to labels configuration (a803193)
• add Repo Assist labels to central config (#161) (b41fbfe)
• add reusable workflow to sync upstream Kyverno policies and update README with usage instructions (b119b9f)
• add schedule trigger for sync labels workflow (5f3527e)
• add shared workflows (0fe78df)
• add step to append hosts file if it exists (6f22cd1)
• add upload-coverage action for GitHub Code Quality (#170) (60d895a)
• add upsert-issue composite action (#55) (e3a0bd5)
• add VERSION_ARGS input to dotnet-embed-binaries workflow for version retrieval (a648561)
• add workflow for cleaning up ghcr packages (856fea4)
• add Zizmor composite action workflow (c0b70d3)
• add Zizmor security analysis workflow and action documentation (dbae7c7)
• add Zizmor workflow configuration (6e1f9b5)
• add Zizmor workflow configuration (2b9e59f)
• add Zizmor workflow configuration (5f1126b)
• cleanup-ghcr-packages: add dry-run/package inputs and CI smoke test (#193) (1dddb9d)
• copilot-skills: drop lockfile, lean on gh skill frontmatter (#95) (7906319)
• create-issues-from-todos: support client-id, deprecate app-id (#271) (9d98cb8)
• dependency-review: add composite for GitHub Dependency Review (#217) (21b2937)
• diagnose-flux: add shared composite action for Flux failure diagnostics (#368) (d59a53c)
• free-disk-space: add composite action to reclaim runner disk (#214) (cbfd433)
• implement dotnet-test action with coverage reporting (b4b4aac)
• merge reusable-workflows into the actions repo (#314) (b282265)
• normalize secret input keys to UPPER_SNAKE_CASE (#69) (82ef4a7)
• remove Codecov upload from coverage actions (#175) (7dbc3c3)
• remove the sync-github-labels composite action (superseded by declarative IssueLabels) (#418) (0d7ff03)
• rename copilot-skills actions to agent-neutral agent-skills (#178) (3556694)
• rename require-checks-in-pr to aggregate-job-checks (#154) (59d3ffb)
• run-dotnet-tests: provision .NET 10 SDK alongside 9 (#186) (6916c45)
• setup-copilot-skills: add composite action to install gh skills (#74) (b35a193)
• standardize actions with verb-purpose naming, add new actions and CI improvements (#52) (8d9a6d9)
• Update README and add new composite actions (c401eac)
• update-copilot-skills: auto-discover skill root directories (#103) (4489b81)
• update-copilot-skills: pin resolved skill refs back into skills-lock.json (#88) (7c34831)
• upload .NET coverage to GitHub Code Quality (#174) (31d3c27)

Bug Fixes

• add checks to skip creation of OCI source and Kustomization if they already exist (1fa3f17)
• add conditional check for Cilium installation in GitOps workflow (e2857f0)
• add Copilot user to auto-merge condition (cc639cb)
• add dependency input for GitHub repo in dotnet-test workflow (7ec8e76)
• add dependency on bootstrap job in deploy workflow (eb8aee2)
• add deploy-dev job to handle deployment in GitOps workflow (16d57d9)
• add environment context to all jobs in gitops-deploy workflow (29e3d6a)
• add GitHub Packages as NuGet source in dotnet-test workflow (3c30545)
• add merge_group event to auto-merge workflow (0a18f95)
• add merge_group to GitOps test workflow (c7063db)
• add merge_group to workflow triggers in dotnet-test and image-lint workflows (57c8045)
• add merge_group trigger to GitOps validate workflow (97a9e8c)
• add missing 'renovate[bot]' user login reference in auto-merge action workflow (e2bd116)
• add missing checkout step in reusable workflow for cluster bootstrap (062dacb)
• add missing connection in workflow diagram in README (ea35790)
• add missing continuation for cgroup.hostRoot setting in Cilium installation (e362800)
• add missing wait flag for Cilium installation in GitOps workflow (dadc93f)
• add mtls to cilium in bootstrap step (e914ff3)
• add permissions section for GitOps workflow (675818e)
• add push trigger for main branch in release workflow (3fa15c1)
• add reusable TODOs workflow (5d0d10c)
• add suspend and resume commands for kustomization in reconcile step (3d82e8d)
• add workflow_dispatch trigger to sync labels workflow (531e764)
• address review feedback on require-checks-in-pr action (#116) (8fa6997)
• allow 'devantler' to trigger auto-merge job (7b8d8c9)
• allow NuGet push to continue on error (5baba33)
• approve-pr,upsert-issue: retry-harden unguarded gh network calls (#405) (7fe5fad)
• correct condition syntax for dependency installation in dotnet-test workflow (382545e)
• correct emphasis on "Composite Action" in diagram (865a142)
• correct formatting of auto-merge condition for consistency (b0b8a4e)
• correct indentation in flux tag artifact command (8710100)
• correct syntax for dependency condition in dotnet-test workflow (dd3795d)
• correct terminology in workflow diagram in README (ce725cb)
• correct user login reference in auto-merge action workflow (f11f256)
• correct wording in README introduction for clarity (17ebd8b)
• Delete .github/workflows/active-enable-auto-merge.yaml (a533979)
• deps: update create-github-app-token action to v2.2.1 (884a9b7)
• disable kubeProxyReplacement in Cilium installation (74e7ef8)
• enable Gateway API features in Cilium installation (938ee58)
• enable kubeProxyReplacement and set k8sServiceHost and k8sServicePort in Cilium installation (cfb0fa0)
• enable-auto-merge-on-pr: retry-harden the gh API/merge network calls (#402) (b0e24b5), closes #401
• enhance ksail update command with deployment tool specification (d9515f6)
• ensure token is passed during checkout step in auto-merge workflow (8ac9c47)
• github-app: update automation settings for PR review and remote control (17691ce)
• labels: add roadmap to canonical label set so weekly sync stops deleting it (#253) (b31ec7b)
• move Renovate configuration file (a6290f7)
• normalize action input names (#72) (961f62f)
• pass skills directory to gh skill update to fix write path (#108) (907b940)
• refine condition for auto-merge job to include pull request event (e018b2e)
• remove deploy-dev job from GitOps test workflow (bd7d1f2)
• remove draft check from .NET test job (b4316e1)
• remove forwardKubeDNSToHost setting from Cilium installation (fc832f4)
• remove hardcoded project reference in todos.yaml (c9cac8d)
• remove outdated README for zizmor-action (9f610a8)
• remove PROJECTS_SECRET from todos.yaml (8bfb9f8)
• remove unnecessary dependency on bootstrap job in push-to-oci (dcf76df)
• remove unused merge_group trigger from auto-merge workflow (7698978)
• remove Zizmor Action and its documentation (005c37f)
• rename job from auto-approve to auto-merge in workflow (c24fbfb)
• rename job from lint to validate in GitOps workflow (5603f0e)
• rename jobs in GitHub workflows for consistency (625fd3b)
• rename secret key to match reusable workflow definition (#60) (095e4c8)
• reorder checkout action in todos workflow (391f482)
• replace Flux installation with KSail installation in deploy step (41ab5a7)
• replace manual Homebrew installation with action for consistency across workflows (0bb1e09)
• replace manual KSail installation with Homebrew for consistency across workflows (505a5ce)
• require-checks-in-pr: restore graceful handling of empty job-results (#138) (19f1f2e)
• resolve first-party self-references at the same commit (#427) (96b8f82)
• restore permissions for issues in todos.yaml (b1f4c87)
• run-dotnet-tests: gate coverage upload on runner.os, not the unavailable matrix context (#241) (8ce1952)
• sanitize tag name for OCI artifact in deployment workflow (61201e1)
• scan-for-todo-comments: restore self-checkout for post-cleanup (#437) (6f07366)
• scope GitHub App tokens to least privilege (zizmor github-app) (#279) (40816ac), closes #274
• set forwardKubeDNSToHost to false in Cilium installation (48d3003)
• setup-copilot-skills: default scope to repo for CI use (#85) (5383a2b)
• setup-copilot-skills: install gh on demand when runner has an older version (#76) (538d710)
• setup-ksail-cli: trust first-party tap so brew can load the KSail Cask (#262) (7848ec0)
• simplify auto-merge condition formatting for readability (3f4f428)
• simplify auto-merge condition formatting in workflow (6b44303)
• simplify dependency installation condition in dotnet-test workflow (e4171c4)
• specify version for reusable workflow in active-release.yaml (b2d85ee)
• update action paths in workflow files to use local references (44620f6)
• update action references to specific versions in multiple workflows (d69de4b)
• Update action.yaml (f378f06)
• update actions/checkout to persist-credentials: false for improved security (df6427f)
• update auto-merge condition formatting for clarity (85a3844)
• update auto-merge condition to exclude draft pull requests (7ba542f)
• update auto-merge condition to exclude draft pull requests (f6c779a)
• update auto-merge workflow to use GitHub App Token for authentication (f2b7abc)
• update auto-merge-action reference to specific commit for consistency (b8298f5)
• update condition for auto-merge job to use pull request user login (b58c3a0)
• update dependency installation condition to use env variable (8b28c8c)
• update diagram in README to accurately represent workflow relationships (ff00c64)
• update dotnet-test action reference to use the latest version (e146fe7)
• update dotnet-test-action usage to local path (74fdadf)
• update dotnet-test-action usage to local path and add working directory (#13) (3685954)
• update EndBug/label-sync action to specific commit for stability (4c00454)
• update GitHub Actions relationship diagram for clarity and accuracy (0df4ee9)
• update host and root CA file checks to use vars fallback (b891ccc)
• update name of NuGet source step to reflect GHCR usage (baaf98b)
• update output setting for current Kubernetes context in reconcile step (08a2df7)
• update README to include links for reusable workflows and composite actions (715aedf)
• update reusable workflow callsites for naming refactor (#53) (73f2eb4)
• update workflow diagram to correct relationships and add missing connections (88bed98)
• update workflow reference in active-release.yaml (d4b23f9)
• update zizmor action reference to specific commit for consistency (3899a97)
• update Zizmor workflow triggers to use workflow_call only (9b0d3e7)
• update-copilot-skills: address post-merge review comments (#92) (bf04cc0)
• upsert-issue: fail with a clear error when body-file is missing (#385) (aabeddb)
• use UPPER_SNAKE_CASE for secret input keys (#67) (f99f6c9)
• workflows: revert step-security actions to original authors (#134) (5daa8b5)

Code Refactoring

• agent-skills: share the gh bootstrap via one script (#211) (14c9fed)
• approve-pr: accept client-id, deprecate app-id input (#290) (555e27d)
• consolidate test workflows into single ci.yaml (#121) (3b7af5b)
• remove workflow_dispatch and merge_group triggers from multiple workflows (ba4dab8)
• rename job in dotnet-embed-binaries workflow (10ef47a)
• rename secret inputs to kebab-case (#65) (33461ab)
• rename workflow for embedding binaries in .NET projects (c084677)
• replace inline status-check jobs with require-checks-in-pr action (#118) (e5a89fd)
• run-dotnet-tests: drop dead app-id/app-private-key inputs (#264) (0e12329)
• split enable-auto-merge-on-pr into approve-pr and enable-auto-merge-on-pr (#58) (ba49255)

Continuous Integration

• add enable-auto-merge workflow (#110) (ae7c660)
• add README↔action.yaml input/output parity guard (#197) (6d8bcd6)
• add shared retry.sh and bound setup-ksail-cli network pulls (#302) (b2c1104)
• bound gh-skill network pulls with shared retry helper (#308) (679f53b)
• exempt internal devantler-tech deps from Dependabot cooldown (#232) (3a9a8b2)
• grant release-please the workflows scope for self-pin rewrites (#337) (ea68e2b)
• guard ci.yaml test wiring and fix silently-ignored free-disk-space results (#355) (16239bb)
• scan main on push so code-scanning baseline stays current (#275) (eeb1b95)
• skip CI suite and dependency-review on release-please PRs (#359) (7f215f7)
• skip the suite on the release-commit push to dodge the self-pin tag race (#412) (91efa53)
• switch from Renovate to Dependabot (#50) (f1fcdf7)

---

This PR was generated with Release Please. See documentation.

[botantler-1]

🤖 Created releases:

• v9.0.0

🌻